Really Simple Security logo

Log out
Get PRO

Latest

Input validation vulnerability in Checkout Field Editor 1.7.4

  • Severity: medium-risk
  • Status: Open
  • Publication: September 11, 2023

The Checkout Field Editor plugin for WordPress is vulnerable to a type of attack known as Cross-Site Request Forgery. This means that up to version 1.7.4, it was possible for unauthenticated attackers to update checkout fields without needing to be authenticated. All it would take is for an administrator to click on a link the attacker had sent them. This is because the Checkout Field Editor plugin was not validating nonces when updating checkout fields.

Detected in:

Checkout Field Editor fixed vulnerable versions:
woocommerce-checkout-field-editor open vulnerable versions: >= * <= 1.7.4

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.